ClawHub
Back to skill

Security audit

News Summary

Security checks for vulnerabilities and agentic risk

Overview

This is a real news-to-Telegram skill, but it automatically installs recurring background execution and disables browser sandboxing, so users should review it before installing.

Install only if you are comfortable with a Telegram bot token stored locally, outbound posts to Telegram, and a cron job that runs three times daily. Prefer adding the cron entry manually, pin Playwright versions, keep config.json private and out of version control, and run the browser scraper in a restricted environment with Chromium sandboxing enabled.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T06 · System Persistence

Error
Location
scripts/install.sh:82
Finding

Installer Automatically Establishes Recurring Cron Persistence

Content
View full analysis
> $LOG_DIR/news_summary.log 2>&1" if crontab -l 2>/dev/null | grep -q "news_summary_v2.sh"; then echo " ✅ Cron job đã có" else echo " 📝 Thêm cron job..." (crontab -l 2>/dev/null; echo "$CRON_LINE") | crontab - echo " ✅ Cron job đã thêm!" echo " → Chạy lúc 8h, 12h, 16h hàng ngày" fi ``` ### Technical Analysis The general-purpose installation script modifies the invoking user's crontab and registers `news_summary_v2.sh` to execute three times every day. The schedule supports the declared automatic news-delivery feature and is documented in `SKILL.md`; therefore, it is not concealed. Nevertheless, it creates cross-session persistence automatically and without a dedicated opt-in prompt. The installer only checks whether any existing crontab line contains `news_summary_v2.sh`. It does not use a unique managed marker, show the exact proposed entry for approval, provide an uninstall operation, or verify that the target script and its parent directories cannot be modified by less-trusted users. This behavior exceeds the minimum privilege necessary for basic installation or a one-time news summary. Persistent scheduling should be a separate, explicitly authorized action. ### Attack Path 1. A user runs `bash scripts/install.sh`. 2. The installer constructs a cron entry referencing the Skill's shell wrapper. 3. Without requesting confirmation, it appends that entry to the user's crontab. 4. Cron subsequently invokes `scripts/news_summary_v2.sh` at 08:00, 12:00, and 16:00 every day. 5. The wrapper runs the Python file present at the configured path. 6. If ...[truncated 744 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:110
Finding

Playwright Installation Instructions Use Unpinned Dependencies

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/scrape_baomoi_v2.js:5
Finding

Remote Web Content Is Processed with the Chromium Sandbox Disabled

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (26)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared purpose is a news aggregation and Telegram delivery skill, but the provided code only reads a local JSON configuration file and prints values. This is a materially different primary purpose and involves filesystem access not mentioned in the description. None of the core declared behaviors—collecting news, processing articles, or sending Telegram messages—are present in this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description presents a broader news aggregation and Telegram delivery skill spanning four Vietnamese news sources. The supplied code chunk implements only a narrow scraper for Báo Mới headlines and links. It lacks any logic for scraping VnExpress, Tuổi Trẻ, or Dân Trí, any aggregation across sources, any scheduling/daily orchestration, and any Telegram bot/API interaction. This is a material description-behavior mismatch in primary purpose and capabilities.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/news_summary_v2.py (reported line 193)May include surrounding context.

python
if not os.path.exists(scraper):
        return results

    env = os.environ.copy()
    if node_path:
        env['NODE_PATH'] = node_path

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill documents capabilities that require shell execution, network access, environment/config handling, and scheduled execution, but it does not declare any explicit tool scope or permissions boundary. That creates unnecessary ambiguity for reviewers and automated runners, increasing the chance the skill is executed with broader privileges than intended.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The instructions direct users to place a Telegram bot token in config.json and call the Telegram API with the token in the URL, but they do not explicitly warn that the token is a secret. This increases the likelihood of accidental disclosure through screenshots, shell history, logs, copied commands, backups, or committing the config file to version control.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
81% confidence
Finding

The skill is explicitly designed to send data to Telegram, which is an external service, so external transmission is real and should be treated as a data-flow risk. Even if only chat metadata is fetched in the documented step, the overall skill's purpose includes transmitting aggregated content and potentially sensitive channel identifiers or tokens to third-party infrastructure.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

  • Thêm bot làm Admin (quyền Post Messages)
  • Gửi tin nhắn vào channel → lấy CHAT_ID:
    text
    https://api.telegram.org/bot<TOKEN>/getUpdates
    Tìm chat.id trong response (format: -100xxxxxxxx)

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

The cron setup creates persistent scheduled execution, which increases risk because network-capable code will continue running unattended and can repeatedly use stored credentials. If the script or dependencies are later modified, persistence amplifies impact by automatically re-executing the changed code without fresh review.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

4. Cài cron

bash
crontab -e
# Thêm dòng (giờ VN = UTC+7):
0 8,12,16 * * * cd /home/YOUR_USER/workspace/skills/news-summary/scripts && python3 news_summary_v2.py >> /home/YOUR_USER/.openclaw/logs/news_summary.log 2>&1

Rp1

Medium
Category
MCP Rug Pull
Confidence
84% confidence
Finding

Using npx playwright without pinning an exact version allows whatever version is current at install time to be fetched and executed. This weakens supply-chain integrity and can introduce breaking or malicious package changes into the skill environment.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
84% confidence
Finding

The later npx playwright install chromium usage also depends on an unpinned Playwright toolchain, so browser installation behavior is tied to whichever package version is resolved. This exposes the setup flow to avoidable supply-chain and reproducibility risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script attempts to read a hard-coded config file from /home/pc999/.openclaw/workspace/config.json before trying local project paths. For a news-summary skill, accessing a user workspace configuration outside the skill directory is unrelated to the stated purpose and can expose secrets or unrelated user data if this helper is invoked by other components.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
96% confidence
Finding

This logic checks and manages a cron-based persistence mechanism for news_summary_v2.sh, indicating the installer is preparing recurring execution. Even though cron is common for legitimate automation, adding persistence in an install script for a Telegram-posting bot increases risk because it enables periodic background execution and outbound communications without later user interaction.

Content

Scanner excerpt · scripts/install.sh (reported line 86)May include surrounding context.

sh
SCRIPT_PATH="$SCRIPT_DIR/news_summary_v2.sh"
CRON_LINE="0 8,12,16 * * * $SCRIPT_PATH >> $LOG_DIR/news_summary.log 2>&1"

if crontab -l 2>/dev/null | grep -q "news_summary_v2.sh"; then
    echo "  ✅ Cron job đã có"
else
    echo "  📝 Thêm cron job..."

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The installer persistently modifies the user's crontab without interactive confirmation or an opt-in flag, creating scheduled execution that survives the current session. In a skill that fetches news and posts to Telegram, this means unattended recurring network activity and log generation can be established unexpectedly, which is a meaningful persistence and consent issue.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
98% confidence
Finding

This command appends a new cron entry directly into the user's crontab, establishing persistent scheduled execution. In context, the scheduled script will repeatedly access external news sources and send data to Telegram, so unauthorized or unnoticed installation could create ongoing data transfer, resource use, and a foothold for later script changes to execute automatically.

Content

Scanner excerpt · scripts/install.sh (reported line 90)May include surrounding context.

sh
echo "  ✅ Cron job đã có"
else
    echo "  📝 Thêm cron job..."
    (crontab -l 2>/dev/null; echo "$CRON_LINE") | crontab -
    echo "  ✅ Cron job đã thêm!"
    echo "  → Chạy lúc 8h, 12h, 16h hàng ngày"
fi

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file's comments and user-facing status/message strings are written in Vietnamese, and the generated summary title/content is explicitly Vietnamese. Under the language/locale policy, forcing a specific language without user choice is a natural-language policy concern unless the locale restriction is documented and justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code sends data over the network to the Telegram Bot API using BOT_TOKEN and CHAT_ID loaded from local configuration. While the script logs success or errors, it does not clearly disclose before transmission that it will send collected content to an external service, and this file contains no docstring or comment warning about that behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/news_summary_v2.py (reported line 74)May include surrounding context.

python
'disable_web_page_preview': 'true',
    }).encode()
    req = urllib.request.Request(
        f'https://api.telegram.org/bot{BOT_TOKEN}/sendMessage',
        data=data,
        headers={'User-Agent': UA}
    )

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

A news summarization skill is expected to fetch and format content, but this code also executes an external JavaScript scraper, expanding capability beyond simple HTTP retrieval. That broader execution surface increases supply-chain and local file replacement risks, especially because the scraper may be loaded from workspace paths outside the script directory.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The code launches an external script with subprocess.run, which is a safety-relevant operation because it executes another program from the local environment. Although the behavior may support the skill's purpose, this file does not include a clear warning, confirmation, or explanatory comment near the execution point about running external code.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
89% confidence
Finding

The script spawns an external Node.js process to run a scraper, which creates a code-execution boundary outside the Python file’s core logic. Although the command is invoked without a shell, it still executes whatever binary is resolved as 'node' or provided via environment, so a compromised runtime or replaced scraper can run arbitrary code under the agent’s privileges.

Content

Scanner excerpt · scripts/news_summary_v2.py (reported line 198)May include surrounding context.

python
env['NODE_PATH'] = node_path

    try:
        proc = subprocess.run(
            [node_bin, scraper],
            capture_output=True, text=True, timeout=30,
            env=env

Tainted flow: 'node_bin' from os.environ.get (line 170, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Confidence
97% confidence
Finding

The executable path comes from NODE_BIN in the environment and is passed directly into subprocess.run, allowing an attacker controlling the environment to substitute an arbitrary program. In agent or automation environments where skills may run with inherited environment state, this becomes a straightforward arbitrary code execution vector.

Content

Scanner excerpt · scripts/news_summary_v2.py (reported line 198)May include surrounding context.

python
env['NODE_PATH'] = node_path

    try:
        proc = subprocess.run(
            [node_bin, scraper],
            capture_output=True, text=True, timeout=30,
            env=env

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The natural-language instructions and description are entirely in Vietnamese, which effectively forces a specific language for use of the skill. The file does not indicate that the Vietnamese-only scope is intentional, optional, or limited to a region-specific audience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file includes human-readable comments in Vietnamese only, such as the file description and fallback note, with no indication that the user can choose another language. This can violate language/locale policy when a skill imposes a language without opt-in or documented justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The helper silently reads a user workspace configuration file with no user-facing disclosure, confirmation, or indication of what values may be accessed. Even if intended for convenience, undisclosed access to workspace config can leak tokens, chat IDs, or other sensitive settings to a skill whose stated function is only news aggregation and Telegram delivery.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

Multiple comments and echoed instructions are presented only in Vietnamese, which effectively forces a specific language for users interacting with the skill. The policy allows locale constraints when justified or optional, but this file does not provide an opt-in language choice or indicate that the skill is intentionally region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.